SSO login and the consent

Kevin opens Claude Desktop and asks for a loan lookup. Okta SSO kicks in. Watch what Descope puts in the token.

DocsMCP servers ↗SSO authentication ↗User consent flow ↗

Section 1 · MCP server auth

Clients authenticate to Descope, then connect to loan-ops-mcp with a scoped JWT. The server validates every call; tools pull downstream credentials from the Connections Vault.

Step 2 — Claude authenticates to Descope, which federates Okta for workforce SSO. Roles land in the scoped JWT; loan-ops-mcp validates that JWT on connect.

1 / 6

Client auth → Descope · authorized call

SSO / connection token → downstream credential

Unregistered or unauthenticated (blocked)

Claude Desktop · loan-ops-mcp

●https://auth.northwind.com

No login session yet.

The decoded JWT

Issued by Descope · raw token

eyJhbGciOiJSUzI1NiIsImtpZCI6IlAyVTRoSk5wIn0.eyJzdWIiOiJrZXZpbkBub3J0aHdpbmQuY29tIiwicm9sZXMiOlsibG9hbi1tYW5hZ2VyIiwiY3NtIl0sInRlbmFudElkIjoibm9ydGh3aW5kLXVzIiwiaXNzIjoiaHR0cHM6Ly9hdXRoLm5vcnRod2luZC5jb20iLCJhdWQiOiJsb2FuLW9wcy1tY3AiLCJzY29wZXMiOlsibG9hbnM6cmVhZCIsImxvYW5zOmFwcHJvdmUiXSwiZXhwIjoxNzQwMTcyMzAwLCJpYXQiOjE3NDAxNjg3MDB9.gV5pE8R3KZ0nMxz9wQfYJqVtL2hTjP4kRfBcD8XaUwY

Header

{
  "alg": "RS256",
  "kid": "P2U4hJNp"
}

Payload

"sub":"kevin@northwind.com"
Who the user is — the principal.
"roles":["loan-manager", "csm"]
Mapped from Kevin's Okta groups at login.
"tenantId":"northwind-us"
Tenant context — Section 4's policy uses this.
"iss":"https://auth.northwind.com"
"aud":"loan-ops-mcp"
"scopes":["loans:read", "loans:approve"]
Derived from roles. The MCP server checks these per tool.
"iat":1740168700
"exp":1740172300

Worth noting: if Northwind's workforce ever authenticates against something that isn't SAML/OAuth, Descope External Authentication handles that path. The MCP client sees the same shape of JWT either way.